oikos phase 0: ontology + inventory + policy seeds, OpenAPI contract, ADRs

- seeds/ontology.yaml: 59 entity types (5 abstract, is-a hierarchy), 46
  relationship types with cardinality, 6 lifecycles with terminal states
  and named precondition checks
- seeds/inventory.yaml: 110 entities / 142 relationships translated from
  legacy inventory.yaml (fleet, services, ingress, storage, governance,
  archaeology); thin spots marked for backfill
- seeds/policy.yaml: 4 risk classes, 27 approval rules (hierarchy-aware,
  per-entity overrides), autonomy kill-switch off (cold start)
- api/openapi.yaml: full v1 REST contract (40 paths), RFC 9457 errors,
  cursor pagination, idempotency, ETag/If-Match, scopes; redocly-clean
- docs/adr/0001-0010: initial architecture decision records
- scripts/validate-seeds.py: Phase 0 gate — hierarchy, lifecycles,
  endpoints, cardinality, policy cross-refs (0 errors)
- plan: layer CHECK gains 'meta' (root type), cardinality gains
  'many-to-one'

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/adr/README.md

@@ -0,0 +1,18 @@
+# Architecture Decision Records
+
+MADR-style records for Oikos. One decision per file, numbered, never edited
+after acceptance — superseding decisions get a new ADR that links back.
+Statuses: proposed | accepted | superseded-by-NNNN.
+
+| ADR | Title |
+|---|---|
+| [0001](0001-go-single-binary.md) | Go with single-binary role packaging |
+| [0002](0002-postgres-timescale-only-datastore.md) | PostgreSQL + TimescaleDB as the only datastore |
+| [0003](0003-db-native-ontology-yaml-seeds.md) | DB-native ontology with YAML seed manifests |
+| [0004](0004-openapi-first.md) | Contract-first OpenAPI API |
+| [0005](0005-uuidv7-plus-slug-identity.md) | UUIDv7 + slug entity identity |
+| [0006](0006-learning-proposal-only.md) | Learning is proposal-only (no self-authorization) |
+| [0007](0007-threat-model.md) | Threat model and trust zones |
+| [0008](0008-forward-only-migrations.md) | Forward-only migrations |
+| [0009](0009-sse-over-websocket.md) | SSE over WebSocket for the event stream |
+| [0010](0010-infisical-with-sops-fallback.md) | Infisical secrets with SOPS DR fallback |